WaterPlum：朝鲜攻击活动借虚假面试任务感染3万台设备

1. Basic Information Original Title: North Korean "WaterPlum," commonly referred to as “Contagious Interview,” Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe Source: National Police Agency, NCO, FBI, DC3, ASD's ACSC, BND, BfV Publication Date: 2026-09-18 Update Date: None Severity: Critical Basis for Severity: Government agencies in the US, Australia, Germany, and Japan announced that between December 2025 and July 2026, at least 30,000 devices across more than 100 countries were infected, assets or credentials were stolen from over 7,000 crypto wallets, and at least 1.7 billion JPY worth of cryptocurrency was transferred to North Korea. Original Link: North Korean "WaterPlum," commonly referred to as “Contagious Interview,” Cyber Actor Group Targeting IT Professionals; Activities of North Korean IT Workers in Japan, the United States and Europe Related Source: The Record Coverage Related Entities: WaterPlum, Contagious Interview, BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, StoatWaffle, North Korean IT Workers 2. Executive Summary Fake AI and cryptocurrency companies or recruiters trick victims into executing malicious npm packages or VS Code projects as interview tasks, stealing information and establishing persistent access through RATs. This creates opportunities to compromise organizations that employ or contract with the victims. 3. Attack Flow Invasion from Fake Interviews to Personal Devices and Corporate Environments Attackers approach IT professionals on social media, job boards, gig work platforms, and freelance marketplaces. Under the guise of online interviews or coding tasks, they trick victims into downloading and executing files from code repositories or collaborative development services. They distribute BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle via malicious npm packages. StoatWaffle also uses malicious VS Code projects that execute automatically after being trusted. RATs and info-stealers gather browser credentials, clipboard data, keystrokes, screenshots, crypto wallets, and identification documents. They maintain persistent access, creating opportunities to compromise the companies or contractors where victims work. The number of successful corporate compromises has not been disclosed. Alternative Vectors by North Korean IT Workers Using fake resumes, VPNs, AI-driven face/voice/translation support, and laptop farms operated by local accomplices, they pose as legitimate hires to gain corporate access and compensation. This vector does not always coincide with the aforementioned malware infections. 4. Attacker Location and Execution Environment Attackers pose as recruiters or job candidates from outside the target region, using social media, recruitment services, VPNs, and VPSs. Malware runs on applicants' personal or development devices. Stolen credentials and persistent access can then create opportunities to compromise corporate environments. 5. Visibility for Victims and Administrators Victims: The scenario appears as a lucrative job offer, technical interview, code fix task, or troubleshooting steps for video conferencing issues. Administrators: Indicators include unapproved npm packages, execution from external repositories, trusted VS Code workspaces, unknown Node.js or Python processes, and access to cryptocurrency-related data. 6. Success and Failure Conditions Success Conditions The victim executes unknown code on a daily-use device or trusts a malicious VS Code project. The device has access to browser credentials, crypto wallets, corporate VPNs, and source code. Failure Conditions Task code is executed in an isolated sandbox, separated from devices holding personal assets and corporate credentials. During hiring, candidates' identity, location, credentials, IP addresses, and payment destinations are verified through multiple paths, and the principle of least privilege is strictly enforced. 7. Impact upon Success Crypto wallets, browser credentials, identification documents, screenshots, keystrokes, and corporate data are stolen. Victims' identities and employer access may be abused for additional employment fraud, extortion, or corporate intrusion. 8. Observable Logs Email: Communications posing as job offers or interviews, and links to task files or external repositories. Proxy / SWG / DNS: Retrieval of unknown packages from sources like GitHub and Bitbucket, and connections to C2 infrastructure. Endpoint / EDR: npm install executions, Node.js or Python child processes, automated VS Code task execution, and heavy access to browser data or crypto wallets. Identity / IdP: New sessions originating from victim devices, and logins from unusual countries or VPS providers. SaaS / Cloud: Token usage in code repositories, chat tools, and cloud development environments. Network: Persistent RAT C2 traffic, and new connections from personal devices to corporate environments. 9. Attack Success Assessment Confirmed via Public Information Information Theft or Session Compromise Confirmed: The joint advisory indicates at least 30,000 device infections and the theft of assets or credentials from over 7,000 wallets. Criteria for Internal Assessment User Action Confirmed: Evidence that task code, npm packages, or VS Code projects were downloaded and executed. Malware Execution or Authentication Success Confirmed: Corroboration of BeaverTail or similar processes, persistence mechanisms, C2 connections, and RAT sessions. Subsequent Compromise Confirmed: Evidence of unauthorized access to corporate VPNs, code repositories, or cloud environments. 10. Investigation Playbook Trigger: Suspicious processes following recruitment tasks, unknown npm dependencies, or automated VS Code execution. Initial Verification: Preserve recruitment communications, senders, repositories, downloaded files, and execution timestamps. Endpoint: Investigate Node.js, Python, and VS Code history, crypto wallets, browser data access, and RAT persistence. Authentication & Cloud: Revoke all sessions and tokens stored on the device. Subsequent Activity: Track access to victims' employers or contractors, abuse of identification documents, and asset transfers. Containment: Isolate devices, block C2 communication, update credentials, and migrate crypto wallets. Classification: Distinguish between contact, code execution, device compromise, data theft, and corporate intrusion. 11. Defense and Detection Ideas Single Event: Detect npm install commands originating from unapproved repositories, trusted VS Code workspaces, and unknown outbound Node.js traffic. Timeline Correlation: Correlate recruitment contact, code retrieval, execution, browser and crypto wallet access, and C2 connections. Hunting: Search broadly for known artifacts of BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle. Log Gaps: When personal devices are used for corporate access, initial execution cannot be observed from the corporate side alone. Prioritized Measures: Prioritize isolated environments for recruitment tasks, separation of BYOD devices, least privilege access, identity verification, and contractor management. 12. Facts / Inference / Hypothesis Facts The NPA and FBI assess that WaterPlum actors and some North Korean IT workers operate under the 313 General Bureau of the Munitions Industry Department, subordinate to the Central Committee of the Workers' Party of Korea. Between December 2025 and July 2026, at least 30,000 devices across more than 100 countries were infected, assets or credentials were stolen from over 7,000 wallets, and at least 1.7 billion JPY worth of cryptocurrency was transferred to North Korea. Malicious npm packages and VS Code projects have been confirmed as distribution vectors. Inference When recruitment activities, development environments, personal wallets, and corporate access intersect on the same device, a single infection can expand its impact to both personal and corporate assets. Hypothesis No additional hypotheses. Unverified items are listed under "Unknowns and Further Investigation." 13. MITRE ATT&CK Mapping T1566.003 Spearphishing via Service (Confidence: Medium): Targeting individuals via social media, job boards, gig work, and freelance services using fake job offers. T1059.007 JavaScript/JScript (Confidence: High): Executing Node.js-based malware and malicious npm packages. T1555 Credentials from Password Stores (Confidence: High): Accessing browser credentials. 14. Unknowns and Further Investigation Breakdown of the 30,000 devices, organizational impact, and ratios of each malware family. Number of successful lateral movements into corporate environments and their correlation with personal device compromises. Validity period of public IOCs and current C2 infrastructure. 15. Impact on SOCs and Organizations The joint advisory explicitly identifies IT professionals and organizations as targets and highlights the dismantling of a laptop farm operated by an enabler in Japan. Recruitment, contracting, personal devices, and cryptocurrency management should not be treated as separate issues; instead, organizations must design common controls around the isolated execution of unknown code and the minimization of post-hire access. 16. Summary by Role SOC: Cross-correlate evidence across departments regarding recruitment communications, development tools, C2, and corporate accounts. Administrators: Establish sandboxes for running tasks, enforce least privilege, and verify the identity of contractors and new hires. Users: Do not execute unknown interview task code on personal devices or devices used to manage crypto wallets.